feat: design-pack registry — modules can contribute a site-wide look - #235

Adds the framework half of the design-pack feature. This is the piece
antosubash/simple_module_python_modules#1
is blocked on: its canopy_atlas module imports simple_module_core.design_packs,
which doesn't exist in any released or in-repo framework build, so the module
fails to load at boot and that repo's E2E suite goes red on the first test.

What a design pack is

A stylesheet a module ships that restyles the public site by overriding the
base design tokens beneath a <value>-root class. Before this, the only site
with a pack hard-coded it into pagebuilder — meaning a generic module shipped
one particular site's brand.

Core

• simple_module_core.design_packs — DesignPack(value, label) and
  DesignPackRegistry, sitting beside MenuRegistry / PermissionRegistry /
  PublicRouteRegistry. Both re-exported from the package root.
• ModuleBase.register_design_packs(registry) — a new no-op-by-default hook.
• Services gains a required design_packs slot.

Two deliberate strictnesses:

• Slug shape. ^[a-z0-9][a-z0-9-]*$, validated in __post_init__ so an
  invalid pack can't be constructed at all. The slug becomes a CSS class
  fragment, so a module with a bad one fails at import rather than at render.
• No silent overwrite. Registering a slug twice raises. Two packs sharing a
  root class would leave whichever stylesheet loaded last in charge — not
  something an administrator could diagnose from the UI.

Registering advertises a pack; it does not load the stylesheet. The CSS still
reaches the bundle via the host's styles.css. The registry exists so an
administrator can't select a pack nothing provides.

Hosting

create_app collects every module's packs in dependency order and publishes the
registry on app.state.design_packs (and app.state.sm.design_packs).

app_builder.py was sitting one line under the hard 300-line cap, so the
host-settings registration block moved to _phase_helpers.register_host_settings
— splitting by responsibility as CLAUDE.md prescribes rather than squeezing the
file. The hosting suite is byte-identical in outcome across that move
(180 passed / 2 skipped before and after).

Branding

The selected pack is a branding setting, not a per-page property — one site, one
look, read from shared props.

• design_pack on settings, BrandingOut, BrandingUpdate; designPack in the
  shared-props payload and the BrandingShared TS type.
• PUT /api/branding/ rejects a slug no installed module registered (422). The
  check lives in the endpoint because only there is app.state.design_packs
  reachable; the settings and DTO validators enforce shape alone.
• A pack dropdown on the Manage page, fed by a designPacks page prop.

Shape and registration are checked in different places on purpose: settings are
hydrated from the DB at boot, so a pack whose module has since been uninstalled
degrades to an unstyled site rather than refusing to start. Only a live write is
rejected.

The branding view and endpoint both reach the registry via getattr, so this
published module still runs against a host older than the registry — it just
offers no packs to choose from.

Testing

Written test-first throughout — every test was watched failing before the code
that satisfies it.

• framework/core/tests/test_design_packs.py — 23 tests: slug validation, frozen
  dataclass, registration order, copy-on-read, duplicate rejection, membership.
• framework/core/tests/test_module_base.py — hook default no-op + override.
• framework/hosting/tests/test_design_packs_wiring.py — the registry reaches
  app.state and a module's registered pack lands in it.
• modules/branding/tests/test_design_pack.py — 16 tests across settings, DTO,
  payload, and the API's accept / reject / clear / leave-untouched behaviour.

Verified locally: make lint exit 0 (ruff format + ruff + ty + biome + per-workspace
tsc + 300-line cap + metadata/README checks), 1505 passed, 2 skipped on pytest,
41 passed on vitest.

make doctor reports SM020 (both users and keycloak auth providers installed
in the dev workspace) and two SM003 orphan pages in keycloak / audit_log —
all pre-existing and untouched by this change.

After merge

Cutting the release is the maintainer's call. Once simple_module_core /
simple_module_hosting / simple_module_branding ship a version carrying this,
the modules repo can move its pins and PR #1's E2E suite unblocks.